WO2019139595A1

WO2019139595A1 - Offline authorization of interactions and controlled tasks

Info

Publication number: WO2019139595A1
Application number: PCT/US2018/013396
Authority: WO
Inventors: Theodore Harris; Tatiana KOROLEVSKAYA; Yue Li
Original assignee: Visa International Service Association
Priority date: 2018-01-11
Filing date: 2018-01-11
Publication date: 2019-07-18
Also published as: US11855971B2; US20210234848A1

Abstract

A method is disclosed and includes receiving, by a first communication device, a first local authentication model, the first local authentication model being derived from a master authentication model at a remote server computer, and receiving a request to perform an interaction with a second communication device, the interaction being performed in an offline manner. The method may further include applying, by the first communication device, the first local authentication model to the interaction to determine a first authentication result and determining whether or not to allow the interaction to proceed based upon the first authentication result. The method may also include updating the first local authentication model using the master authentication model when the first communication device is online.

Description

OFFLINE AUTHORIZATION OF INTERACTIONS AND CONTROLLED TASKS

CROSS-REFERENCES TO RELATED APPLICATIONS

[0001] None.

BACKGROUND [0002] Users rely on their mobile phones to perform a variety of tasks including taking and sharing photos, receiving news updates, engaging in mobile banking, conducting payments, etc. Typically, these tasks and interactions take place in an online environment, where the mobile device is connected to the internet using a cellular data or WiFi connection. Sometimes users interact with their mobile phones in an offline setting. This may be due to a lack of network coverage, or possibly, a desire to prevent private data from being widely shared over the internet.

[0003] The processing of mobile services and interactions is usually maintained centrally by online service providers, which can guarantee the security and legitimacy of its services to its users. For example, payments made using a mobile payment application may typically rely on a centralized server for authorizing and/or validating transactions. When a mobile phone is offline, the availability of necessary services such as authorization of payments may be non-existent.

[0004] Embodiments of the invention described herein address these and other problems, individually and collectively. BRIEF SUMMARY

[0005] Embodiments provide systems, apparatus, and methods for securely authorizing offline interactions.

[0006] One embodiment of the invention includes a method comprising: receiving, by a first communication device, a first local authentication model, the first local authentication model being derived from a master authentication model at a remote server computer; receiving, by the first communication device, a request to perform an interaction with a second communication device, the interaction being performed in an offline manner; applying, by the first communication device, the first local authentication model to the interaction to determine a first authentication result; determining, by the first communication device, whether or not to allow the interaction to proceed based upon the first authentication result; and updating, by the first communication device, the first local authentication model using the master authentication model when the first communication device is online. [0007] Another embodiment of the invention includes a communication device configured to perform the above method.

[0008] Another embodiment of the invention includes a method comprising receiving, by a server computer, data for a plurality of requests to perform a plurality of

interactions generated at a plurality of communication devices; generating, by the server computer, a master authentication model based on the data for the plurality of requests to perform the plurality of interactions; deriving, by the server computer, one or more local authentication models from the master authentication model; and distributing, by the server computer, the one or more local authentication models to one or more communication devices, wherein the one or more communication devices apply one or more requests to perform one or more offline interactions to the one or more local authentication models to determine an authentication result for the one or more requests.

[0009] Another embodiment of the invention includes a server computer configured to perform the above method. [0010] A better understanding of the nature and advantages of the present invention may be gained with reference to the following detailed description and the

accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] FIG. 1 shows an illustration of a system comprising computing devices for secure authorization of interactions according to embodiments.

[0012] FIG. 2 shows a block diagram of an exemplary user device (e.g , a

communication device) according to an embodiment.

[0013] FIG. 3 shows a swim-lane diagram of an online authentication process for a device action according to an embodiment.

[0014] FIG. 4 shows a swim-lane diagram of an offline authentication process for a device action according to an embodiment. [0015] FIG. 5 shows an illustration of an interaction according to an embodiment.

[0016] FIG. 6 shows a data flow diagram for an online authentication process conducted from a user device according to an embodiment.

[0017] FIG. 7 shows a data flow diagram for an offline authentication process conducted from a user device according to an embodiment. [0018] FIG. 8 shows an illustration of a graph model update according to an embodiment.

TERMS

[0019] Prior to discussing embodiments of the invention, descriptions of some terms may be heipful in understanding embodiments of the invention. [0020] A“credential” may be any suitabie information that serves as reliable evidence of worth, ownership, identity, or authority. A credential may be a string of numbers, letters, or any other suitable characters, as well as any object or document that can serve as confirmation. Examples of credentials include value credentials, identification cards, certified documents, access cards, passcodes and other login information, etc. [0021] An“application” may be computer code or other data stored on a computer readable medium (e.g. memory element or secure element) that may be executable by a processor to complete a task

[0022] An“application programing interface” or“API” may be a software intermediary that allows two separate applications, devices, or entities to communicate. This can include a set of routines, protocols, and tools for building said applications, so as to specify how different software components should interact.

[0023] A“risk model^” may be a predictive model for determining the riskiness of current actions based on a history of previous actions. This may include comparing new data to old data that has been labeled as risky. Risk models used for the purpose of authenticating a user can also be referred to as“authentication models.”

[0024] A“master authentication model” can be an authentication model that is used as a main authentication model for which other authentication models can reference or be updated with. For example, the master authentication model can be maintained by a service provider that provides updates to devices in this manner, a master

authentication model may be considered to be the most up to date or most accurate A master authentication module can take into account data with respect to a large variety of users, devices, and circumstances.

[0025] A“local authentication model” can be an authentication model that exists on a user device. For example, the local authentication model can be a portion of a master authentication model or a master authentication model that has been reduced to a smaller file size. A location authentication model can include or be formed from data that is specifically associated with the user device, the circumstances (e.g., location) surrounding the user device, or the user and circumstances surrounding the user [0026] An“authentication result” can be a determination that something or someone is or is likely to be authentic. For example, an authentication result may be a decision that a user is genuinely who he or she says he or she is. For example, an authentication result can be positive if a user’s identify is confirmed, while an authentication result can be negative if a user cannot be correctly identified. [0027] The term“online” may refer to a state in which a device is connected over interconnected networks, such as through the Internet. In such a manner, the device is able to receive and send data globally across connections. The term“offline” may refer to any state in which a device is not online.

[0028] An“authorization request message” may be an electronic message that requests authorization for an interaction. An authorization request message according to some embodiments may comply with ISO 8583, which is a standard for systems that exchange electronic interaction information associated with a user using an issued user account. The authorization request message may include an issuer account identifier that may be associated with the user’s account. An authorization request message can also comprise additional data elements corresponding to“identification information” including, by way of example only: a service code, a CVV (card verification value), a primary account number (PAN), a token, a user name, an expiration date, etc. An authorization request message may also comprise“interaction information,” such as any information associated with a current interaction, such as an interaction location, transaction amount, resource provider identifier, resource provider location, bank identification number (BIN), merchant category code (MCC), information identifying resources being provided/exchanged, etc., as well as any other information that may be utilized in determining whether to identify and/or authorize an interaction.

[0029] An“authorization response message” may be a message that responds to an authorization request. The authorization response message may include, by way of example only, one or more of the following status indicators: Approval - transaction was approved; Decline - transaction was not approved; or Call Center - response pending more information, merchant calls the toll-free authorization phone number. The authorization response message may also include an authorization code. The code may serve as proof of authorization for an interaction.

[0030] A“server computer” may include a powerful computer or cluster of computers. For example, the server computer can be a large mainframe, a minicomputer cluster, or a group of servers functioning as a unit. In one example, the server computer may be a database server coupled to a Web server. The server computer may be coupled to a

3 database and may include any hardware, software, other logic, or combination of the preceding for servicing the requests from one or more client computers. The server computer may comprise one or more computational apparatuses and may use any of a variety of computing structures, arrangements, and compilations for servicing the requests from one or more client computers

[0031] A“user device” may be a device that is operated by a user. Examples of user devices may include a mobile phone, a smart phone, a personal digital assistant (PDA), a laptop computer, a desktop computer, a server computer, a vehicle such as an automobile, a thin-ciient device, a tablet PC, etc. Additionally, user devices may be any type of wearable technology device, such as a watch, earpiece, glasses, etc. The user device may include one or more processors capable of processing user input. The user device may also include one or more input sensors for receiving user input. As is known in the art, there are a variety of input sensors capable of detecting user input, such as accelerometers, cameras, microphones, etc. The user input obtained by the input sensors may be from a variety of data input types, including, but not limited to, audio data, visual data, or biometric data. The user device may comprise any electronic device that may be operated by a user, which may also provide remote communication capabilities to a network. In such instances, the user device can be referred to as a “communication device." Examples of remote communication capabilities include using a mobile phone (wireless) network, wireless data network (e.g., 3G, 4G or similar networks), Wi-Fi, Wi-Max, or any other communication medium that may provide access to a network such as the Internet or a private network.

[0032] A“graphics processing unit” or“GPU” may refer to an electronic circuit designed for the creation of images intended for output to a display device. The display device may be a screen, and the GPU may accelerate the creation of images in a frame buffer by rapidly manipulating and altering memory. GPUs may be have a parallel structure that make them more efficient than general-purpose CPUs for algorithms where the processing of large blocks of data is done in parallel. Examples of GPUs may include Radeon™ HD 6000 Series, Polaris™ 1 1 , NVIDIA GeForce™ 900 Series,

NVIDIA Pascal™, etc.

4 [0033] The term“artificial intelligence model^” or“Ai model” may refer to a model that may be used to predict outcomes in order achieve a target goal. The AI model may be developed using a learning algorithm, in which training data is classified based on known or inferred patterns. One type of Ai model may be a“machine learning model.”

[0034] “Machine learning” may refer to an artificial intelligence process in which software applications may be trained to make accurate predictions through learning.

The predictions can be generated by applying input data to a predictive model formed from performing statistical analysis on aggregated data. Machine learning that involves learning patterns from a topological graph can be referred to as“graph learning”

[0035] A“topological graph” may refer to a representation of a graph in a plane of distinct vertices connected by edges. The distinct vertices in a topological graph may be referred to as“nodes.” Each node may represent specific information for an event or may represent specific information for a profile of an entity or object. The nodes may be related to one another by a set of edges, E. An“edge” may be described as an unordered pair composed of two nodes as a subset of the graph G = (V, E), where is G is a graph comprising a set V of vertices (nodes) connected by a set of edges E. For example, a topological graph may represent a transaction network in which a node representing a transaction may be connected by edges to one or more nodes that are related to the transaction, such as nodes representing information of a device, a user, a transaction type, etc. An edge may be associated with a numerical value, referred to as a“weight”, that may be assigned to the pairwise connection between the two nodes.

The edge weight may be identified as a strength of connectivity between two nodes and/or may be related to a cost or distance, as it often represents a quantity that is required to move from one node to the next.

[0036] A“feature” may refer to a specific set of data to be used in training a machine learning model. An input feature may be data that is compiled and expressed in a form that may be accepted and used to train an artificial intelligence model as useful information for making predictions. In some embodiments, an input feature may be identified as a collection of one or more input nodes in a graph, such as a path comprising the input nodes.

5 [0037] A“subgraph” or“sub-graph” may refer to a graph formed from a subset of elements of a larger graph. The elements may include vertices and connecting edges, and the subset may be a set of nodes and edges selected amongst the entire set of nodes and edges for the larger graph. For example, a plurality of subgraph can be formed by randomly sampling graph data, wherein each of the random samples can be a subgraph. Each subgraph can overlap another subgraph formed from the same larger graph.

[0038] A“community” may refer to a group/collection of nodes in a graph that are densely connected within the group. A community may be a subgraph or a

portion/derivative thereof and a subgraph may or may not be a community and/or comprise one or more communities. A community may be identified from a graph using a graph learning algorithm, such as a graph learning algorithm for mapping protein complexes. Communities identified using historical data can be used to classify new data for making predictions. For example, identifying communities can be used as part of a machine learning process, in which predictions about information elements can be made based on their relation to one another.

[0039] A“data set” may refer to a collection of related sets of information composed of separate elements that can be manipulated as a unit by a computer. A data set may comprise known data, which may be seen as past data or“historical data.” Data that is yet to be collected or labeled, may be referred to as future data or“unknown data.” When future data is received at a later point it time and recorded, it can be referred to as“new known data” or“recently known” data, and can be combined with initial known data to form a larger history.

[0040] “Unsupervised learning" may refer to a type of learning algorithm used to classify information in a dataset by labeling inputs and/or groups of inputs. One method of unsupervised learning can be cluster analysis, which can be used to find hidden patterns or grouping in data. The dusters may be modeled using a measure of similarity, which can defined using one or metrics, such as Euclidean distance.

6 [0041] An“interaction” may be a reciprocal action that involves more than one actor. For example, an interaction between devices can include the exchange of data. As another example, interactions between consumers and merchants can be referred to as “transactions.” DETAILED DESCRIPTION

[0042] Embodiments described herein are directed to secure device interactions, authentication, and offline authorization. As previously explained, users may wish to interact with each other and exchange data between devices in an offline setting and in a secure manner. However, the exchange of data between devices and the processing of such data in the devices was generally allowed to proceed without any restrictions. Embodiments provide for methods, devices, and systems that allow for offline analysis of user device data by local devices. The local devices can conduct risk analyses and can control access to applications and functions, and data processing according to models that can be updated on a continual basis by a master analytical model on a remote server computer As such, an interaction between two devices and the processing of data by those devices can be controlled with up to date control logic, despite the inability of those devices to connect online to the remote server computer during the desired interaction.

[0043] FIG. 1 shows an illustration of computing devices for secure authorization of interactions according to embodiments. In embodiments, a plurality of users, such as user 101 , 102, 103, 104, etc may each possess a user device 1 1 1 , 1 12, 1 13, 1 14.

Each user device 1 1 1 , 1 12, 1 13, 1 14 can be a mobile device, such as a mobile phone, laptop, smart watch or other wearable device, etc.

[0044] Each user 101 , 102, 103, 104 may connect over to communications network 120 using the network communication interface in their user device 1 1 1 , 1 12, 1 13, 1 14.

For example, each user device 1 1 1 , 1 12, 1 13, 1 14 may use cellular data or WiFi to connect to the internet. Through the communications network 120, each user device 1 1 1 , 1 12, 1 13, 1 14 may establish communications with one or more remote server computers, so as to access a desired function or service provided by the one or more remote server computers. This may include server computers in the remote authentication system 130 and data processing servers 140.

[0045] Remote authentication system 130 may include one or more computers (e.g., server computers) operatively coupled together, where one or more of the computers performs different functions in a secure authentication implementation. For example, remote authentication system 130 may comprise a plurality of server computers configured to process authentication requests and/or perform message routing to one or more authentication service providers. In one embodiment, remote authentication system 130 may be a centralized point of communication between user devices and data processing servers 140. In the embodiment, the computers of remote

authentication system 130 may comprise interfaces for handling requests/responses of varying formats between said user devices and data processing servers. For example, a request comprising a biometric template associated with the user to securely authenticate user 101 from user device 1 1 1 can be transmitted to remote authentication system 130. The remote authentication system 130 may then reformat the request for transmission to a biometric verification service provided by data processing server 141. A response can then be received by remote authentication system 130 from data processing server 141 and forwarded to user device 1 1 1 to deliver an authentication result.

[0046] Data processing servers 140 may include a plurality of server computers (e.g. data processing server 141 , 142, 143, 144, etc.), which may each be capable of processing data relating to authentication/authorization of actions undertaken by users on their user devices. Each data processing server may be configured to perform a specialized function or type of authentication. For example, data processing server 141 may be a biometric verification server that verifies biometric data of a user. Meanwhile, data processing server 142 may be a risk scoring server that evaluates the riskiness of interactions based on known occurrences of fraud (e.g. evaluating an interaction as risky if it involves a device reported as stolen). In an embodiment, remote

authentication system 130 may utilize one or more functions/services provided by data processing servers 140 to evaluate interactions for authorization purposes, and may be

8 configured to route messages to the appropriate data processing server to perform each function.

[0047] !n embodiments, users may be capable of interacting and transferring data between user devices locally in an offline manner. For example, user 101 may use a local area network or a Bluetooth™ capability of user device 1 1 1 to interact with user 102 and exchange data with user device 1 12. Similarly, user 103 may use a

Bluetooth™ capability of user device 1 13 to interact with user 104 and exchange data with user device 1 14. The interactions can be, for example, the transfer of contact information, image files, video files, music files, documents, digital currency, etc. For example, an interaction may involve user 101 transferring cryptocurrency

stored/maintained at an application of user device 1 1 1 to user 102, such that user 102 may access the cryptocurrency through a similar application stored at user device 1 12 and use the associated funds to conduct purchases thereafter.

[0048] FIG. 2 shows a block diagram of an exemplary user device according to an embodiment of the invention. The user device 210 can be any suitable computing device, such as a mobiie device, wearable device, personal computer, and/or Internet of things or“iOT” device. An exemplary user device can include user device 1 1 1 , 1 12,

1 13, and/or 1 14 operated by user 101 , 102, 103, and 104 of FIG. 1 respectively.

[0049] User device 210 may comprise a data processor(s) 21 1 for processing electronic instructions as information. For example, the data processor can include any number of central processing units (CPUs) and/or graphics processing units (GPUs). Data processor(s) 21 1 may be configured to execute instructions stored in a computer- readable medium, such as from an internal and/or external memory.

[00S0J User device 210 may additionally comprise device driver(s) 212. Device driver(s) 210 may include software for translating data messages into a form that hardware elements coupled to user device 210 can understand. For example, device driver(s) 210 may interpret input/output instructions of an operating system of user device 210 as tasks that can be performed by a screen and/or camera of user device 210, such as enabling the camera to take a picture and display it to a user of the device.

9 [0051] User device 210 may further comprise file store 213. File store 213 may comprise a portion of memory in which device data can be stored. This may include encrypted files 213A and non-encrypted files 213B. For example, file store may comprise a store of encrypted messages and passwords for the user of user device 210 as well as a non-encrypted cache of device operational data such as memory usage, CPU usage, application instail/uninstail history, etc.

[0052] User device 210 may also comprise authentication application 214.

Authentication application 214 can include software stored in a memory of user device 210 that allows for secure authentication and authorization of device operations and interactions. The authentication application 214 may comprise a number of modules including local risk analyzer 214A, decision engine 214B, risk analyzer update module 214C, data conversion module 214D, and offline communicator 214E.

[0053] Local risk analyzer 214A may comprise computer-readable instructions for analyzing device data and applying the data to a locally stored risk model. In one embodiment, local risk analyzer 214A may comprise instructions for detecting one or more anomalies associated with an interaction. The local risk analyzer 214A (e.g., in conjunction with the data processor(s) 21 1 ) may compare collected device information to an event history and/or a cache history of recorded command sequences. For example, local risk analyzer 214A may determine that a request is associated with an abnormally high rate of CPU usage, memory usage, or other device behavior that may deviate from values expected based on previously recorded data. Other examples of collected device information from which an anomaly can be observed from may include a device location, a history of connected devices, network connection history, a last update timestamp, activity since the last update, a last device reboot timestamp, and/or a last device recharge timestamp.

[0054] The detection of an anomaly may initiate a risk analysis process for determining a risk score for the interaction. For example, an interaction relating to a data transfer of a music file to user device 210 from an unknown device may involve an unknown device that has not received the latest software update for conducting interactions. The absence of the latest update on the unknown device may trigger local risk analyzer

10 214A to initiate the risk analysis process, which may comprise applying information for the data transfer to a locally stored learning model that is trained for identifying potential computer viruses. The learning model may obtain and analyze the information for the data transfer (e.g. file size, device location, etc.) and may then determine a risk score quantifying the probability that the music file is actually a malicious program.

[00S5] Decision engine 214B may comprise instructions for evaluating incoming data and determining an appropriate response and/or action. In one embodiment, decision engine 214B may comprise a behavior tree. The behavior tree may include various actions that can be queried based on the analyzed risk of incoming data. For example, the behavior tree may comprise an action of‘restrict offline access’ for interaction data that has received a risk score of 90 or higher (i.e. high risk interaction).

[0058] Risk analyzer update module 214C may comprise instructions for synchronizing a local risk model with information of a master authentication model maintained by a remote authentication system. The master authentication model may comprise new information relating to recent data that has been collected from other devices in a network, and the new information may allow for more accurate risk modeling and identification of fraud. For example, user device 210 may lose network coverage during a period of time in which a fraudulent actor has interacted frequently in the network. Fraudulent activity performed by the actor may be logged and identified by the remote authentication system and expressed in the master authentication model so that the master authentication model is up to date. When the user device 210 regains network connectivity, the local risk model may be updated to account for the recent fraudulent activity.

[00S7J The remote authentication system may comprise a processor, and a computer readable medium coupled to the processor. The computer readable medium may comprise code, executable by the processor for receiving data for a plurality of requests to perform a plurality of interactions generated at a plurality of communication devices; generating a master authentication model based on the data for the plurality of requests to perform the plurality of interactions; deriving one or more local authentication models from the master authentication model; and distributing the one or more local

11 authentication models to one or more communication devices, wherein the one or more communication devices apply one or more requests to perform one or more offline interactions to the one or more local authentication models to determine an

authentication result for the one or more requests.

[0058] As a more specific illustration, the local risk analyzer 214A may have been updated by the master authentication model at time T1 when the user device 210 is online and capable of communicating with the remote authentication system. At time T2, the user device 210 may be offline, and at T3, the user device 210 may attempt to interact with another user device to conduct an interaction. At time T4, the user device 210 may retain connectivity with the remote authentication system and may be updated with updated data from the master authentication model at the remote authentication system. Between T1 and T4, the master authentication model may be updated with other transaction data, and the local risk analyzer 214A may not be updated with this information. For example, prior to T2, the local risk analyzer 214A may have taken into account that five potentially fraudulent transactions have been conducted by other user devices in the vicinity of the user device 210. Between T 1 and T4, the remote authentication system may be notified that two additional potential fraudulent transaction have been conducted by user devices in the vicinity of the user device 210. The local risk analyzer 214A may not have taken this information into account when analyzing the interaction at T3, but it may nonetheless be sufficient to make an accurate determination as to whether the user device 210 should or should not proceed with the proposed interaction at T3. When the user device 210 is back online, the local risk analyzer 214A may be updated to account for the information regarding the two additional potentially fraudulent transactions. In addition, the master authentication model may be updated with information from the local interaction between the user device 210 and the other device involved in the local interaction.

[0059] Data conversion module 214D may comprise instructions for converting data values into a different form in one embodiment, data conversion module 214D may comprise instructions for performing a data encryption method. For example, the data conversion module 214D may comprise instructions for encrypting device information in

12 a manner that allows for secure multi-party computation, such as obfuscating clear text values according to Yao’s garbled circuit or other suitable garbled circuit protocol.

[0060] Offline communicator 214E may comprise instructions for receiving offline requests and delivering offline responses between interacting devices. For example, the offline communicator 214E may comprise code for generating Bluetooth™ messages (e.g., classic and BLE - Bluetooth™ Low Energy), and broadcasting

Bluetooth™ messages to nearby devices. Offline communicator 214E may comprise instructions for exchanging data through any suitable offline communication means, such as through near-field communications, RFID, SS7 signaling, etc. [0061] Furthermore, user device 210 may comprise communication interface(s) 215 for formatting and reformatting data messages. As such, user device 210 may be capable of sending and receiving messages properly and successfully during an interaction and/or software update. For example, communication interface(s) 215 may comprise instructions for formatting an SMS text message or Internet protocol message that can be sent over antenna 216. As another example, communication interface(s) 215 may include instructions for pairing user device 210 with one or more nearby devices over Bluetooth.

[0062] User device 210 may comprise an antenna 216 for sending and receiving data messages wirelessly. For example, antenna 216 may be cellular antenna for connecting to a telecommunications network. Antenna 216 may be capable of sending and receiving data coverage by any available means, such as through 3G, 4G, 5G,

LIE, WiFi, etc.

[0063] According to embodiments, a user device may be capable of conducting interactions, such as payment transactions and other data transfers. These interactions can be authorized online or offline, and may initiate an online or offline authentication process for identifying the user of the device and verify his or her credentials. For example, authentication may comprise verifying usernames, passwords, payment credentials as well as conducting appropriate risk scoring for identifying and preventing fraud.

13 [0064] FIG. 3 shows a swim-lane diagram of an online authentication process for a device action according to an embodiment. Process 300 may involve a user 301 controlling a user device (not shown). An example of an exemplary user device may include user device 210 of FIG. 2. The user device may comprise controlled

application(s) 310A and authentication application 310B. Process 300 may further utilize remote authentication system 330 and data processing server(s) 340, which may be similar to the remote authentication system 130 and data processing server(s) 140 of FIG. 1 respectively.

[0065] At step S301 , user 301 initiates an action using controlled application 310A stored on his or her user device. Controlled application 310A may be any application for performing an action that requires secure authorization and/or authentication of the initiating users and/or user devices. For example, the controlled application 310A may be a mobile banking application, digital wallet application, cryptocurrency application, file sharing application, etc. The initiated action can be, for example, a login process into a personal account, a digital payment, the transfer of a file between devices, etc.

[0066] At step S302, controlled application 310 sends an authentication/authorization request to authentication application 310B. For example, a request to authenticate user 301 so that he or she can access his or her personai account associated with controlled application 310A (e.g. social media account, banking account, investment portfolio, etc.) may be generated. As another example, a request to authorize a transaction (e.g. a purchase at a merchant or a funds transfer with another user) can be generated by controlled application 310A may be generated and sent to authentication application 310B.

[0067] At step S303, the authentication application 31 OB sends an update request to remote authentication system 330. Upon receiving the authentication/authorization request in step S302, the authentication application 31 OB may then request an update from a remote server so as ensure that the authentication application 31 OB contains the latest information. For example, the authentication application 31 OB may contain a local risk model that may be updated with information of a master risk model containing more recent and more accurate risk analyses. In one embodiment, the update request may

14 comprise device information collected since the last time authentication application 31 OB was updated. For example, the update request may comprise a last update timestamp, an uninstall/insta!i history, a cache/history of activity in the controlled application, a network connectivity history, etc.

[0068] At step S304, remote authentication system 330 processes the update request. The remote authentication system 330 may receive the update request and may determine the necessary update and installation data that needs to be sent back to the authentication application 310B. For example, data for a local risk model stored at authentication application 310B may be compared to a master risk model stored at remote authentication system 330 to determine update data. In one embodiment, the remote authentication system may record device information received in the update request. For example, the remote authentication system may record the device location and network connection, which can then be used to provide additional data for risk analyses performed by the remote authentication system 330. Other external data such as transaction data associated with transactions not conducted by the user device or the user of the user device may be used to the remote authentication system 330 to update a master risk model.

[0069] At step S305, remote authentication system 330 sends an update to

authentication application 310B. The update may comprise the update and installation data determined in step S304. in one embodiment, the update data may comprise graph data for a graph based learning model.

[0070] At step S306, authentication application 310B requests a scan from controlled application(s) 310A. The scan may be for device data of one or more devices involved in the requested action. For example, the action may involve a funds transfer between two devices, and the requested scan may be a request to scan both devices involved. As another example, the action may involve an adjustment of user settings and/or preferences stored at a device, and the scan may involve the device at which user settings/preferences are being adjusted. During the scan, data can be collected to update a master authentication model or local risk analyzer (which is an example of a local authentication model).

15 [0071] At step S307, controlled app!ication(s) scans for device information of one or more devices involved in an interaction in one embodiment, the scan may be performed using an API provided by an entity associated with authentication application 31 OB. For example, the scan may be included as part of the update provided to authentication application 31 OB in step S305.

[0072] The scan may comprise the collection of relevant information about the usage of the involved devices. For example, the relevant information may include the GPS coordinates of the devices, the level of usage of specific applications (e.g. amount of time spent on application/time with application open, amount of memory, and/or amount of CPU usage), and/or the time of day that an action is requested. In one embodiment, the collected device information may be related to features (e.g risk features) learned by an artificial intelligence model to identify abnormal behavior. For example, a user device may initiate a transaction at night in a downtown area although the user device belongs to a user that typically transacts during the day in a suburban area, and thus the interaction may potentially be identified as abnormal based on the features of“time of day" and“location.” In one embodiment, the artificial intelligence model may be a graph model or graph learning model comprising user communities. For example, each user community may be defined by features that identify typical behavior and actions of included users on their devices, and actions falling outside of those defining features may potentially be flagged as abnormal/risky. More information regarding using a graph model to identify user communities and characteristic user behavior can be found in international patent application No. PCT/US2017/041537, which is herein incorporated by reference in its entirety for all purposes.

[0073] At step S308, controlled application(s) sends the device information (and any other relevant information) to authentication application 310B. In one embodiment, authentication application 310B may encrypt the device information. The device information may be encrypted according to a method of secure multi-party computation, such as Yao’s garbled circuit, or through standard encryption processes using symmetric or asymmetric encryption keys. The authentication application 310B may

16 then format the device information as part of a data message that can be sent to remote authentication system 330.

[0074] At step S309, authentication application 31 OB receives the device information and forwards the authentication/authorization request inciuding a request for a risk analysis of the device information to remote authentication system 330. The remote authentication system 330 may then receive the authentication/authorization request, and may determine what analyses are necessary for authenticating the involved devices and/or authorizing the requested action. For example, a server computer of remote authentication system 330 may determine that a requested transaction should be risk scored based on its location and purchase amount, and may further determine that the device identifiers for the involved devices should be compared to a negative list of reported stolen devices.

[0075] At step S310, remote authentication system 330 requests data processing from data processing server(s) 340. In one embodiment, various forms of authentication and analyses may be performed remotely by individual data processing servers specializing in each type of authentication/analysis (e.g. risk scoring, negative lists, user community group/user activity comparison, biometric verification, etc.). The remote authentication system 330 may call out to the particular data processing server over an established network, such that the data processing server may analyze the data and provide an evaluation that can be utilized by the remote authentication system 330 in making an authenfication/authorization decision.

[0076] At step S31 1 , data processing server(s) 340 processes first risk data. The first risk data may include device information of a particular type that a particular data processing server of data processing server(s) 340 is capable of analyzing. For example, the data processing server may determine a risk score based on a device location, a time of day, and a transaction amount.

[0077] At step S312, remote authentication system 330 receives a first risk analysis result for the first risk data. For example, the remote authentication system 330 may receive a risk score from a server of data processing server(s) 340. As an example, the

17 risk score may have a value of 70: moderate risk,’ which may be used as a factor in authorizing the requested action.

[0078] At step S313, remote authentication system 330 requests data processing for second risk data in one embodiment, the request received from authentication application 310B in step S309 may contain multiple types of risk data. Second risk data separate from first risk data processed at step S31 1 may be sent to a specialized server for analysis. For example, the second risk data may comprise one or more device identifiers involved in the requested action, which a specialized server of data

processing server(s) 340 can compare to a negative list of stolen devices. This may allow data processing server to flag the requested action as fraudulent and aid in determining an authorization result.

[0079] At step S314, data processing server(s) 340 processes the second risk data.

For example, a data processing server may obtain a device identifier and/or user account identifier and may compare the idenlifier(s) to a database of negative lists for devices and/or accounts reported as hacked or stolen. The data processing server can then generate a notification of listed’ or‘not listed’ as reported.

[0080] At step S315, data processing server(s) 340 sends a second risk analysis result to remote authentication system 330. For example, the data processing server(s) 340 may send a result to the remote authentication system 330 that indicates that the devices and/or accounts have been flagged as fraudulent. The remote authentication system 330 can then use the second risk analysis as a factor in determining an authorization result.

[0081] At step S316, remote authentication system 330 determines an

authentication/authorization result. The authentication/authorization result may be based on one or more risk analyses, including the first risk analysis and second risk analysis received in steps S312 and S315 respectively. In one embodiment, the authentication/authorization result may further be based on a master risk model of remote authentication system 330. For example, a graph learning model generated based on historical actions performed by a plurality of user devices may be used to

18 determine if the requested action matches expected behavior Examples of historical actions can include, but may not be limited to, a quantity of actions requested over time, authentication information or settings, device settings changed, and a recorded history of opening or utilization of specified applications. Based on the characteristics and/or features of the requested action in relation to the graph learning model, it can be determined if the involved user/user devices are behaving as expected, and thus whether or not they should be authorized.

[0082] At step S317, remote authentication system 330 sends a response to the authentication/authorization request sent by controlled application(s) 310A in step S302. The authorization result determined in step S316 may be included in a data message that can be sent and received by a mobile device on which authentication application 310B is stored. For example, an authentication result of‘valid user’ may be included in an authentication response message which may be generated and sent by a server computer to authentication application 310B over a secure communications channel it should be understood that any number of suitable communications means may be used to transmit and receive the response, such as WiFi, SMS, SS7 signaling, Bluetooth, 3G, 4G, 5G, etc.

[0083] At step S318, authentication application 310B forwards the response to controlled appiication(s) 310A. In one embodiment, controlled application(s) 310A may comprise an API for receiving responses from authentication application 310B and interpreting each response in order to allow or block access to the requested action.

For example, controlled application(s) 310A may be an application for controlling an IOT device of user 301 (e.g. remotely controlling a home security/climate system,

communicating with a self-driving car, and/or interacting with any other automated machine or appliance). As such, the controlled application(s) 310A may allow or block access to user preferences or other inherent facilities based on responses received from authentication application 310B.

[0084] At step S319, the response is communicated to the user. For example, an indication of‘access denied’ or‘access granted’ may be displayed on a screen to the user. As other examples, the response can be spoken to the user and/or

19 communicated to the user using an assigned sound or haptic feedback (e.g. a wearable device beeping twice for‘authorized’ and vibrating for‘declined’)

[0085] FIG. 4 shows a swim-lane diagram of an offline authentication process for a device action according to an embodiment. Process 400 may involve a user 401 operating a user device (not shown). The user 401 and operable user device can be any user and user device shown in FIG. 1 respectively (l.e. user 101 , user device 1 1 1 , user 102, user device 1 12, etc.). The user device can also be user device 210 of FIG.

2. Furthermore, user 401 , controlled application 410A, and authentication application 410B may correspond to user 301 , controlled application 310A, and authentication application 310B of FIG. 3 respectively

[0086] Process 400 may further involve a local risk model(s) 410B-I stored locally on the user device of user 401. In one embodiment, local risk model(s) 410B-I may be included as part of authentication application 410B. Local risk model(s) 410B-I may be a predictive model for identifying risk based on historical information and trends. For example, local risk model(s) 410B-I may comprise a machine learning model that has been trained using device information collected over time in one embodiment, the local risk model(s) 410B-I may comprise a graph learning model in an embodiment, the local risk modei(s) 410B-I can be a portion of a master risk model. For example, the master risk model may comprise a graph of user communities, and the local risk modei(s) 410B-I may comprise a portion of the graph containing one or more

communities relevant to user 401.

[0087] At step S401 , user 410 initiates an action at controlled application 410A. For example, the action may be for accessing and/or logging into controlled application 410A. As another example, the initiated action may be an action for changing data stored in the controlled application 410A, such as user information and/or stored files. Other examples of initiated actions may include changing settings and/or preferences, as well as performing an operation such as conducting a transaction or exchanging a data file with another device.

20 [0088] At step S402, controlled application 410A requests approval for the initiated action from authentication application 410B in embodiments, authentication application 41 OB may provide secure authentication and authorization of actions for controlled application 410A In one embodiment, services and functions of authentication application 410B may be provided to controlled application(s) 410 using an API installed at controlled application(s) 410. For example, the API may allow controlled

application(s) 410A to exchange data with authentication application 410B (e.g. such as in the form of a request message or API call) and may additionally allow controlled application(s) 410A to receive and respond to commands for executing requested functions

[0089] At step S403, authentication application 410B receives the request for approval and initiates an offline processing session, after the user device determines that it is not online and/or is incapable of communicating with the remote authentication server. In embodiments, authentication application 410B may be capable of performing

authenfication/authorization tasks in both online and offline settings. As previously explained, online authentication may be supported through communications with a remote authentication system (e.g. remote authentication system 130 of FIG. 1 remote authentication system 330 of FIG. 3) and in conjunction with data processing server(s) for processing a given type of authentication data and performing specialized

authentication tasks/types of risk processing. Meanwhile, in an offline mode where the user device is not connected to a communications network and cannot establish a secure communication channel with the remote authentication system, local risk modeling and analysis can be performed by authentication application 410B. For example, a portion of a master authentication model or compressed file thereof may be stored locally at authentication application 410B, such that device information during a requested action can be analyzed In an offline session. In some instances, the offline session may be terminated and access to controlled app!ication(s) 410A restricted if a requested action can be flagged as risky using the local risk model.

[0090] At step S404, authentication application 410B requests a scan of device information from controlled application 410A. To properly discern if a requested action

21 is legitimate and safe to perform, the collection of device information for involved devices may be required. As such, upon initiating the offline authentication session, authentication application 410B may request a scan of device information that may be relevant for authentication, such as the device location, CPU usage, timestamp of action being taken, amount of memory, install, uninstall history, network connection history, etc. The request for the scan may be generated by authentication application 410B and sent to controlled application 410A, such as in a data message or automated command to controlled application(s) 410A (e.g via a stored API on the user device).

[0091] At step S405, controlled application 410A performs the requested scan of device information. The scan may be for one or more device involved in the action, and may be for the device information sought by authentication application 410B in step S404. For example, the action may involve the transfer of digital currency between user devices, and device information such as device location, CPU usage, timestamp of action being taken, amount of memory, install, uninstall history, network connection history of both devices may be scanned. The scanned device information may be information that can be used to determine if the requested currency transfer is atypical and can further be used to score the action for its probability of involving a fraudulent actor.

[0092] At step S406, controlled application 410A sends the scanned device

information to authentication application 41 OB. The device information may be received by authentication application 41 OB, which may identify, sort, and prepare the

information as data that can be applied to local risk modei(s) 41 GB-I. For example, the device information may be organized as an information vector that can be used as an input to a machine learning model that scores the vector for its probability of fraud.

[0093] At step S407, authentication application 410B receives and applies the device information to local risk model(s) 410B-I. In one embodiment, the local risk model(s) 410B-I may comprise at least a portion of a master authentication model that is remotely store elsewhere. For example, the master authentication model may be a graph learning model stored at a server computer of remote authentication system 130 or 330 of FIG. 1 and FIG. 3 respectively. The local risk model(s) 410B-I may then be a portion

22 of the graph model relevant to user 401 , such as portions of a graph which contain data related to user 401’s activity or data thereof (e.g. user 401’s transaction history, location, browser history, downloads, social media activity, associated devices, etc ).

[0094] At step S408, a risk analysis is performed at the local risk model(s) 410B-I to generate a response/prediction. For example, an output may be generated to the device information applied by authentication application 410B in step S407. As an example, the device information may comprise the location, time, and amount of available memory for two devices involved in a requested data transfer or transaction, which when applied to the local risk model(s) 410B-1 results in a predicted presence of fraud. This may be due to a current device location that is far from the usual device location for user 401 , an unusual time to be transacting, an unusually low amount of available memory, etc.

[0095] At step S409, the response is received from the local risk model(s) 410B-I. For example, the result determine in step S408 may be included in an authentication or authorization response message that restricts access to the requested function or resource. In one embodiment, a behavior tree may be referenced by authentication appiication 410B, so as to query for an appropriate action to fake based on the determined riskiness. For example, the local risk modei(s) 410B-1 may output an indication of‘High Risk,’ which in a behavior tree may be associated with a response of ‘Restrict Access.’

[0096] At step S410, authentication application 410B forwards the response to the controlled application(s) 410A. For example, the response may be reformatted as an API response that communicates the authentication result to controlled application(s)

410A. The response may then command the controlled application(s) 410A to perform an appropriate action such as following through with a data transfer, or instead, denying access and restricting offline usage of the controlled application(s) 410A (e.g. locking out the application until the user device reconnects to the Internet and receives further analyses or updates). [0097] At step S41 1 , the response is communicated to user 401. For example, an Indication of“access denied” or“access granted” may be displayed on a screen to the user. As other examples, the response can be spoken to the user and/or

communicated to the user using any other type of feedback such as sound, vibration, etc.

[0098] FIG. 5 shows an illustration of an interaction according to an embodiment. The interaction can be a transfer of data between a first user 501 and a second user 502 via first user device 51 1 and second user device 512 For example, the data transfer may involve sharing personal information, music files, social media data, digital currency, or any other type file that can be shared between two devices. As another example, the data transfer can be a transfer of data needed to carry out a transaction between a consumer and merchant.

[0099] in embodiments, first user 501 , second user 502, first user device 51 1 , and second user device 512 can be first user 101 , second user 102, first user device 1 1 1 , and second user device 1 12 of FIG. 1 respectively. Furthermore, the first user device and second user device can be user device 210, which may further comprise controlled application(s) 310A and 410 A of FIG. 3 and 4 as well as authentication application 310B and 410B of FIG. 3 and 4. Communications network 520 may be communications network 120 of FIG. 1. [0100] Referring to exemplary interaction 500, Steps 1 through 7 may correspond to actions taken by both parties involved in the interaction. The illustration shown may be of an offline interaction, in which connection to a communications network 520 by either device does not occur until after the interaction has been completed. Steps 1 through 5 may correspond to offline actions, while steps 6 and 7 may correspond to online actions taken when first user device 51 1 and second user device 512 regain access to communications network 520.

[0101] At step 1 , first user 501 and second user 502 initiate an interaction. For example, first user 501 and second user 502 may agree to a transfer of funds, and may wish to use their devices to do so.

24 [0102] At step 2, first user 501 and second user 502 may attempt to carry out the interaction using controlled applications stored at first user device 51 1 and second user device 512 respectively. For example, first user 501 and second user 502 may each open a digital wallet application on their respective devices. The digital wallet application may be a controlled application for which particular functionalities require authentication to access, such as payment and funds transfer functions and/or other permissions such as changing settings, payment methods, and other user preferences. To conduct the funds transfer, the first and second user may enter the appropriate transaction information such as payment amount and payer/payee identity into their devices, which can be manually entered and/or auto filled (e.g. by providing one another with a QR code).

[0103] At step 3, first user device 51 1 and second user device 512 may scan device information. For example, an authentication application stored at each device may send a command to the controlled application to scan for the device’s CPU usage, GPS coordinates, amount of memory, network connection history, etc. The devices may further communicate their scanned device information to each other in one

embodiment, device information may be exchanged using a secure data transfer method such as secure multi-party computation, such as through a garbled circuit protocol (e.g. Yao’s garbled circuit).

[0104] At step 4, the first user device 51 1 and second user device 512 may perform risk analyses on the scanned device information in one embodiment, the risk analysis may be performed at each device by applying the device information to a local risk model. For example, a graph learning model stored at an authentication application at each device may be used to score the probability of fraud associated with the requested interaction based on the CPU usage, GPS coordinates, amount of memory, and network connection history of the first user device 51 1 and second user device 512.

[0105] At step 5, first user device 51 1 and second user device 512 may perform the interaction depending on the risk analyses performed in step 4. For example, for an interaction relating to a payment transaction, the local risk model at first user device 51 1 may determine that the device information is associated with a high risk transaction, and

25 may restrict access to the payment function of the controlled application stored at the first user device 51 1. Conversely, in another example, both the first user device 51 1 and second user device 412 may determine in step 4 that an interaction relating to the sharing of a file between the devices is low risk and may allow the file sharing to take place

[0106] At step 6, first user device 51 1 and/or second user device 512 may regain connection to communications network 520 For example, the communications network 520 may be the Internet, which the first user 501 may access by joining a nearby WiFi connection from first user device 51 1. The WiFi connection may then allow the first user device 51 1 to establish communications with a remote authentication system over the Internet

[0107] At step 7, first user device 51 1 and/or second user device 512 may receive an update from a remote authentication system over communications network 520 The update may be used to update the local risk model stored at the device’s authentication application. In one embodiment, new information relating to markers of risky

interactions that took place while the device was offline may be used to update a local graph learning model at the device such that it may accurately identify risky behavior in future offline interactions and take appropriate action. For example, an identified time of day and place may be associated with fraudulent transactions and/or hacked devices, which may prevent the first user device 51 1 from conducting offline interactions with other devices at the identified time and place.

[0108] FIG. 8 shows a data flow diagram for an online authentication process conducted from a user device according to an embodiment. Online request flow 800 comprises data flows 801 through 617, which may represent the flow of data during an online authentication/authorization process. The online authentication process may correspond to, for example, the process described by diagram 300 of FIG. 3. The process may be for accessing a personal account, a building or transportation terminal, conducting a payment transaction, etc.

26 [0109] When an online authentication process begins, a request 601 for a controlled action is generated at the user device. The user device may have online access and may send a message 604 for contacting a remote authentication system. Meanwhile, device information 602 may be collected, which may be information for one or more devices involved in the controlled action, such as a device location, CPU usage, available/used memory, etc. The collected device information 602 may be stored in a portion of memory 603 for storing events, such as requested actions and associated device information collected. For example, the portion of memory may be a cache history maintained by an authentication application stored on the device

[0110] A decision 605 for an update can be determined, which may be based on a comparison of data stored at an authentication application to data received at the remote authentication system. For example, data for a local risk model stored at the user device may be compared to data for a master risk model stored at the remote authentication system to determine if the local risk model is up to date and contains the most recent data if it is determined that an update is required, an update download 606 may be retrieved by the user device. A scan 607 for potential issues may then be performed, in which case, a re-initialization 608 of the update download 606 may be performed.

[0111] If no potential issues are found, a database update 610 may be performed.

The databases may include a black list 612 of corrupted devices as well as a behavior tree 61 1 for determining appropriate actions to be taken by the user device. After the databases have been updated or after it has been determined that an update is not required, an action lookup 609 may be performed. The action lookup 609 may comprise a query based on the collected device information 602 and in comparison to actions listed in behavior tree 61 1. For example, the behavior tree 61 1 may specify that a data exchange with an interacting device that has less than 1 % available memory should not be authorized.

[0112] Upon performing the action lookup 609, an assessment 613 for initiating risk scoring may be performed. If risk scoring is required, then a risk score 614 may be obtained. Information from an automated device profiling trend and status 616 and a

27 learning database 615 may also be used to create the risk score 615 For example, device information and other interaction data may be compared to a graph learning model to determine a probability of fraud. This may include automated device profiling 616 for evaluating trends and status of the user device, as well as data in a learning database, which may comprise training data and/or machine learning models derived therefrom. Upon determining the risk score or upon determining that the risk score is not required, the authentication result 617 may be output.

[0113] FIG. 7 shows a data flow diagram for an offline authentication process conducted from a user device according to an embodiment. Offline request flow 700 comprises data flows 701 through 721 , which may represent the flow of data in an offline authorization/authentication process. The process can be for authorizing an account change, purchase, funds transfer, or any other offline action requiring a secure processing and/or exchange of data. For example, the offline request may correspond to the processes shown in FIG. 4 and FIG. 5 previously described.

[0114] An initial request 701 to execute a controlled action may be generated at a user device upon indication by a user. Upon initiating the request, device information 702 may be collected. The collected device information 702 may be recorded in an allocated memory store 703 of the user device. For example, memory store 703 may be a portion of memory allocated by an authentication application stored on the device for an events history of data relating to requested actions.

[0115] The device information may further be applied to a statistical analyzer 704 for detecting anomalies. This may include evaluating device information 702 against events history 703 as well as signal knowledgebase 705, which may comprise analyses of command sequences logged by the user device. The events history 703 and signal knowledgebase 705 may be used by the statistical analyzer 704 to compare against the collected device information 702 in order to flag a pattern that falls outside of the mean or causes a major shift in the distribution of expected results. For example, a requested action may be associated with an unusually high level of CPU usage or other abnormal behavior such as a high level of activity and/or memory utilization since the last update, reboot, or recharge of the device.

28 [0116] A determination 706 of an anomaly may be evaluated. If an anomaly in which a significant shift in expected signals has occurred, then risk scoring 709 may be applied to the action request. Based on the risk scoring 709, an inquiry 710 for a potential issue may be performed. If there is a potential issue (e.g. high risk score), then a restriction 71 1 may be placed on the requested action. Furthermore, one or more additional functions of the controlled application may be restricted until the user device gains online access. For example, in the case of a payment application, the user may be prohibited from accessing his or her financial accounts until he or she authenticates over the Internet. A iockout/exit 712 may then be initiated, so as to restrict access to the controlled action(s).

[0117] if the inquiry 710 does not indicate a potential issue or if determination 706 does not find an anomaly, then an action lookup 713 may be executed. The action lookup 713 may comprise querying a behavior tree 714 for an appropriate response based on the device information collected, and in conjunction with a black list lookup 707. The black list lookup 707 may comprise a query for corrupted data listed in black list database 708, which may be a local list of at least a portion of activity recently identified as risky (e.g. device identifiers for stolen devices or files flagged as malware).

[0118] Upon performing the action lookup 713, a decision 715 for determining if a risk score is required may be evaluated. For example, a risk score may be evaluated if the behavior free 714 specifies that an action reiating to financiai accounts may be require a risk score. A risk analysis 716 may be performed if risk scoring is required. The risk analysis 716 may utilize data for a local machine learning model of learning database 717, such as a graph learning model comprising one or more relevant user community groups. In one embodiment, the local machine learning model may comprise data for at least a portion of a master machine learning model maintained by a remote

authentication system. The risk analysis may further utilize data relating to automated device profiling trends and status 718.

[0119] An assessment 719 for a potential issue may be generated based on the risk analysis, in which either an authorization 720 or restriction 71 1 of the requested action can then be implemented. Regarding actions for which a risk analysis is not required,

29 such as actions trivial actions involving non-sensitive data, a simple authorization 721 of the action may be implemented and the requested action may be executed

[0120] FIG. 8 shows an illustration of a graph model update according to an

embodiment. Graph model 800 may comprise data relating to a plurality of requests collected from a plurality of devices, such as first user device 81 1 , second user device 812, and third user device 813. in embodiments, graph model 800 may be used as a master authentication model generated and updated by remote authentication system 830. Furthermore, the master authentication model may be used to derive local authentication models comprising a series of graphs describing a user’s typical request behavior, such as the user’s most likely GPS coordinates, application usage level, and time of day to be making a request.

[0121] Each of the requests may be a request to perform a function of a controlled application stored at each of the devices. The controlled application may be an application in which specific functions require authorization to perform. For example, the controlled application may be a digital wallet application, in which an exchange of assets can be executed via mobile device. An exchange, however, may require an authentication of the users involved, which may be performed by a remote

authentication system when online or locally on a device using a local authentication model when offline. [0122] With reference to FIG. 8, at an initiai time, time = t, second user device 813 may generate first offline request to perform a controlled tasks such as sending an asset to second user device 812. For example, a user of first user device 81 1 may wish to coiiect payment from a user in possession of second user device 812. The first offline request may include request data such as a timestamp for the request, GPS coordinates of devices during the request, etc. In order for the request to be authorized, a scan for device information may be performed and compared to local authentication models. For example, device data 822 stored on second user device 812 may be collected by first user device 81 1 and compared to local model A 821. Based on the comparison of the scanned device information, the request may be evaluated. For

30 example, local model A 821 may determine that the device data 822 may be moderately risky.

[0123] Afterwards, at time = t + 1 , first user device 81 1 may establish communications with remote authentication system 830 over a network. The scanned device information collected during the first offline request 841 as well as device information collected from other requests generated by other devices may be aggregated by the remote

authentication system 830. The remote authentication system 830 may then use the aggregated information to update graph model 800. For example, the updated graph model 800 may comprise an indication that requests associated with a location of“GPS Area 2”, and a timestamp occurring at a time of day between“21 :00 and 24:00” are associated with abnormally high CPU usage and memory consumption by the controlled application and should be flagged as fraudulent. The remote authentication system 830 may further use the updated graph model 800 to derive updated local graph models that can be distributed to a plurality of user devices. More information regarding using distributing portions of a graph model to a plurality of devices can be found in U.S.

Patent Application No. 15/839,094, filed on June 30, 2017, which is herein incorporated by reference in its entirety for all purposes.

[0124] At time = t + 2, third user device 813 may establish communications with remote authentication system 830 over a network. During the established

communication, remote authentication system 830 may provide an update to local model B 823 stored on third user device 813. For example, the updated local model B 823 may comprise new information relating to risk features recently associated with fraudulent behavior.

[012SJ At time = t + 3, second user device 812 may generate a second offline request 842 to interact with third user device 813. Device information from second user device

812 may be scanned and compared to local model B 823 to perform a risk analysis for second offline request 842. Based on the comparison, the third user device 813 may authorize or decline the request. For example, device information 822 may be associated with information marked as high risk or fraudulent by local model B 823, and

31 second offline request 842 may be declined. As such, only requests assessed as low risk by local authentication models stored at involved devices may be authorized offline.

[0126] Embodiments provide a number of technical advantages over prior art.

Embodiments allow for the authorization of operations that are typically limited to an online environment where a remote system can more easily manage security risks and perform authentication tasks. In embodiments, local authentication models derived from a master graph model can be stored at each device, and can be used to assess atypical and fraudulent behavior. The local authentication models can accurately authorize transactions, despite the fact that the devices which use them may not be online. [0127] The specific details of particular embodiments may be combined in any suitable manner without departing from the spirit and scope of embodiments of the invention. However, other embodiments of the invention may be directed to specific embodiments relating to each individual aspect, or specific combinations of these individual aspects.

[0128] It should be understood that the present invention as described above can be implemented in the form of control logic using hardware and/or using computer software in a modular or integrated manner. Based on the disclosure and teachings provided herein, a person of ordinary skill in the art will know and appreciate other ways and/or methods to implement the present invention using hardware and a combination of hardware and software. [0129] Any of the software components or functions described in this application, may be implemented as software code to be executed by a processor using any suitable computer language such as, for example, Java, C++ or Perl using, for example, conventional or object-oriented techniques. The software code may be stored as a series of instructions, or commands on a computer readable medium for storage and/or transmission, suitable media include random access memory (RAM), a read only memory (ROM), a magnetic medium such as a hard-drive or a floppy disk, or an optical medium such as a compact disk (CD) or DVD (digital versatile disk), flash memory, and the like. The computer readable medium may be any combination of such storage or transmission devices.

32 [0130] Such programs may also be encoded and transmitted using carrier signals adapted for transmission via wired, optical, and/or wireless networks conforming to a variety of protocols, including the Internet. As such, a computer readable medium according to an embodiment of the present invention may be created using a data signal encoded with such programs. Computer readable media encoded with the program code may be packaged with a compatible device or provided separately from other devices (e.g., via internet download). Any such computer readable medium may reside on or within a single computer program product (e.g. a hard drive, a CD, or an entire computer system), and may be present on or within different computer program products within a system or network. A computer system may include a monitor, printer, or other suitable display for providing any of the results mentioned herein to a user.

[0131] The above description of exemplary embodiments of the invention has been presented for the purposes of iilustration and description it is not intended to be exhaustive or to limit the invention to the precise form described, and many

modifications and variations are possible in light of the teaching above. The

embodiments were chosen and described in order to best explain the principles of the invention and its practical applications to thereby enable others skilled in the art to best utilize the invention in various embodiments and with various modifications as are suited to the particular use contemplated.

33

Claims

WHAT IS CLAIMED IS:

1. A method comprising:

receiving, by a first communication device, a first local authentication model, the first local authentication model being derived from a master authentication model at a remote server computer;

receiving, by the first communication device, a request to perform an interaction with a second communication device, the interaction being performed in an offline manner;

applying, by the first communication device, the first local authentication model to the interaction to determine a first authentication result;

determining, by the first communication device, whether or not to allow the interaction to proceed based upon the first authentication result; and

updating, by the first communication device, the first local authentication model using the master authentication model when the first communication device is online.

2. The method of claim 1 , wherein determining whether or not to allow the Interaction to proceed based on the first authentication result comprises:

detecting one or more anomalies associated with the interaction;

initiating a risk analysis based on the anomalies to determine a risk score for the interaction; and

determining an appropriate action relating to the risk score.

3. The method of claim 2, wherein the appropriate action relating to the risk score comprises restricting offline access to one or more appiications of the first communication device.

4. The method of claim 2, wherein determining an appropriate action relating to the risk score comprises referencing a behavior tree.

5. The method of claim 1 , wherein the interaction is associated with device information, and wherein the device information includes one or more risk

34 3 features including one or more of: a rate of CPU usage, an install/uninstall history, and a

4 network connection history.

1 6. The method of claim 5, wherein the device information is encrypted

2 using secure multi-party computation.

1 7. The method of claim 1 , wherein the master authentication model is

2 a graph learning model generated from a plurality of requests to perform a plurality of

3 interactions generated at a plurality of devices, and wherein the first local authentication

4 model comprises one or more communities for a user of the first communication device.

1 8. A communication device comprising:

2 a processor;

3 a communication interface; and

4 a computer-readable medium storing instructions executable by the

5 processor, the instructions including a method comprising:

6 receiving a first local authentication model, the first local

7 authentication model being derived from a master authentication

8 model at a remote server computer;

Q receiving a request to perform an interaction with a second

0 communication device, the interaction being performed in an offline1 manner;

2 applying the first local authentication model to the

3 interaction to determine a first authentication result;

4 determining whether or not to allow the interaction to

5 proceed based upon the first authentication result; and

6 updating the first local authentication model using the

7 master authentication model when the communication device is

online.

1 9. The communication device of claim 8, wherein determining whether

D or not to aliow the interaction to proceed based on the first authentication result

3 comprises:

35 detecting one or more anomalies associated with the interaction;

initiating a risk analysis based on the anomalies to determine a risk score for the interaction; and determining an appropriate action relating to the risk score 10. The communication device of claim 9, wherein the appropriate action relating to the risk score comprises restricting offline access to one or more applications of the communication device 1 1. The communication device of claim 9, wherein determining an appropriate action relating to the risk score comprises referencing a behavior tree. 12. The communication device of claim 8, wherein the interaction is associated with device information, and wherein the device information includes one or more risk features including one or more of: a rate of CPU usage, an instail/uninstail history, and a network connection history. 13. The communication device of claim 12, wherein the device information is encrypted using secure multi-party computation. 14. The communication device of claim 8, wherein the master authentication model is a graph learning model generated from a plurality of requests to perform a plurality of interactions generated at a plurality of devices, and wherein the first local authentication model comprises one or more communities for a user of the communication device. 15. A method comprising:

receiving, by a server computer, data for a plurality of requests to perform a plurality of interactions generated at a plurality of communication devices;

generating, by the server computer, a master authentication model based on the data for the plurality of requests to perform the plurality of interactions;

deriving, by the server computer, one or more local authentication models from the master authentication model; and

36

KILPATRICK TOWNSEND 70458430 I distributing, by the server computer, the one or more local authentication models to one or more communication devices, wherein the one or more

communication devices apply one or more requests to perform one or more offline interactions to the one or more local authentication models to determine an

authentication result for the one or more requests

16 The method of claim 15, further comprising:

, receiving, by the server computer, data relating to the one or more

requests to perform the one or more offline interactions;

updating, by the server computer, the master authentication model based on the data relating to the one or more requests to perform the one or more offline interactions to generate an updated master authentication model;

deriving, by the server computer, one or more updated local authentication models from the updated master authentication model; and

distributing, by the server computer, the one or more local authentication models to the one or more communication devices, wherein the one or more

communication devices apply one or more additional requests to perform one or more additional offline interactions to the one or more updated local authentication models to determine authentication results for each of the one or more additional requests.

37